01 Record

CVE-2025-39703

net, hsr: reject HSR frame if skb can't hold tag

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

net, hsr: reject HSR frame if skb can't hold tag

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.36% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 29.4% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-09-05 17:21Z12 MO AGO

Last updated

2026-08-05 12:04Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase
CWE-1286Improper Validation of Syntactic Correctness of InputBase

Data version

5.2

Document digest

de0dd74c35bac93c8970e1104ce43f722e72e2586c3524e9848aa292073413c0

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxf6442ee08fe66c8e45c4f246531a2aaf4f17a7a7 to < 8d9bc4a375a1ba05f7dfa0407de8e510ab9bd14d, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < 3ae272ab523dd6bdc26e879027ed79feac9dd1b3, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < b640188b8a6690e685939053c7efdbc7818b5f4e, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < b117c41b00902c1a7e24347c405cb82504aeae0b, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < acd69b597bd3f76d3b3d322b84082226c00eeaa4, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < 61009439e4bd8d74e705ee15940760321be91d8a, 48b491a5cc74333c4a6a82fe21cea42c055a3b0b to < 7af76e9d18a9fd6f8611b3313c86c190f9b6a5a7, 4ffd1d4a6b306ff69cbe412d2c54d2dd349ff436, 5.10.42 to < 5.10.241, 5.12.9 to < 5.13, 5.13—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8d9bc4a375a1ba05f7dfa0407de8e510ab9bd14d
git.kernel.orghttps://git.kernel.org/stable/c/3ae272ab523dd6bdc26e879027ed79feac9dd1b3
git.kernel.orghttps://git.kernel.org/stable/c/b640188b8a6690e685939053c7efdbc7818b5f4e
git.kernel.orghttps://git.kernel.org/stable/c/b117c41b00902c1a7e24347c405cb82504aeae0b
git.kernel.orghttps://git.kernel.org/stable/c/acd69b597bd3f76d3b3d322b84082226c00eeaa4
git.kernel.orghttps://git.kernel.org/stable/c/61009439e4bd8d74e705ee15940760321be91d8a
git.kernel.orghttps://git.kernel.org/stable/c/7af76e9d18a9fd6f8611b3313c86c190f9b6a5a7
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-032379.html

01 Record index

CVE-2025-39703

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-39703

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References